TIAPS Module 1 Audit and Assurance workbook

circumstances (unethical and often but not always illegal), and tend to provide a
rationalization to themselves and anyone else (such as when they are caught) in terms of
their needs or perceived entitlement (“everyone else is doing it,” “the organization deserves it
for having weak controls,” “it’s only $100,” “I need it more than they do,” “it’s a victimless
crime,” etc.). Often individuals start committing fraud with a small value or with the intention
of only doing it once but the temptation and the rationalization increase. Motivation,
opportunity, and rationalization are the key elements of the fraud risk triangle and provide a
basis for considering appropriate controls for each of these dynamics. Organizations must:
• Reduce motivation (through ethical training and by addressing signs of stress).
• Limit opportunity (through awareness raising and segregation of incompatible duties,
for example).
• Combat potential rationalization (through being seen to take fraud seriously, dealing
with incidents fairly and swiftly, and providing fair compensation to all).
Figure: Controls for the Primary Causes of Fraud (based on the Cressey Fraud Risk
Triangle)
The IIA Practice Guide: Internal Audit and Fraud – Assessing Fraud Risk Governance and
Management at the Organizational Level distinguishes three aspects an internal auditor
must be aware of when evaluating risks and controls:
• Fraud risks – the potential for fraud (which is ever-present).
• Fraud schemes – active plans by individuals or groups to commit fraud.
• Fraud events – where fraud has been committed. 56
56
IIA Practice Guide: Internal Audit and Fraud – Assessing Fraud Risk Governance and Management at the Organizational
Level, 2nd edition, 2022.
61